From d8797ae314a5c6a9a245356c91c477c345e41bef Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui@live.cn>
Date: Fri, 25 Sep 2026 11:32:56 +0800
Subject: [PATCH] Shell (Windows): fixes possible buffer overflow

---
 src/detection/terminalshell/terminalshell_windows.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index 462cd1371..7dc9caf68 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -348,8 +348,8 @@ const FFShellResult* ffDetectShell(void) {
     if (result->processName.length > 0) {
         setShellInfoDetails(result);
         char tmp[MAX_PATH];
-        strcpy(tmp, result->exeName);
-        char* ext = strrchr(tmp, '.');
+        char* end = ffStrCopy(tmp, result->exeName, sizeof(tmp));
+        char* ext = (char*) memrchr(tmp, '.', (size_t) (end - tmp));
         if (ext) {
             *ext = '\0';
         }